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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 



WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of lime may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

I) K Responsive to communication(s) filed on 05 October 2007 . 
2a)l3 This action is FINAL. 2b)Q This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 11, 453 O.G. 21 3. 

Disposition of Claims 

4) H Claim(s) 1-30 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |3 Claim(s) 1-30 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)Q objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

II) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 1 1 9 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)Q All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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1) IZI Notice of References Cited (PTO-892) . 4) □ Interview Summary (PTO-413) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) P a P er No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO/SB/08) 5 ) □ Notice of Informal Patent Application 

Paper No(s)/Mail Date . 6) □ Other: . 
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DETAILED ACTION 
Response to Arguments 

Applicant's arguments filed 10/5/2007 have been fully considered but they are not persuasive. The 
Applicant seasonably argues Claim 1,31,36 and 39; Claim 18 and Claim 30. The Examiner will rebut 
each here. 

Regarding Claim 1, 31, 36 and 39, the Applicant argues that Dessiatnikov fails to disclose the 
obtaining requested connection information from a secure storage file in a file system. 

Dessiatnikov discloses the connection string being stored in a number of locations including 
a configuration file, COM+ catalog and registry see § Security through obscurity & § 
Configuration files. Where the configuration file satisfies the recitation, as configuration file 
is a secure file that is located amongst a number of other files(i.e. file system) needed to 
setup the connection. 

Regarding Claim 18, the Applicant argues that a central directory storing a value string is not present 
in Dessiatnikov. 

Dessiatnikov discloses the storing of connection string in files, registries, source code and 
further encrypting the string information see § Security through obscurity & § Encrypting 
data. 
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Regarding Claim 30, the Applicant alleges that no rejection has been made. The Applicant is asked 
to consult the Non-Final action dated 7/9/2007 again, as the rejection under 35 USC § 103 as 
unpatentable over Dessiatnikov in view of US Patent 2003/0105977t o Brabson has been made. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for 
the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

the invention was known or used by others in this country, or patented or described in a printed publication in this or a 
foreign country, before the invention thereof by the applicant for a patent. 

Claims 1-29, 31-43 are rejected under 35 U.S.C. 102(a) as being anticipated by NPL1 to 
Dessiatnikov. 



Regarding Claim 1, 36, 39, Dessiatnikov discloses the requesting connection information server to 
another node see § Introduction Par. 1; accessing a key phrase to decrypt the requested connection 
information to request connection information see § Encrypting data Par. 3; obtaining the requested 
connection information from secure storage file see § Storage of connection strings. 

Regarding Claim 2, 26, 40, Dessiatnikov discloses the accessing key phrase from a file system of 
server see § Control access to data Par. 2. 

Regarding Claim 3-4, 27, 32, 37, 41, Dessiatnikov discloses the accessing key phrase from a central 
directory of a distributed system see § Configuration files Par. 5 (" The ASP.NET. . ."). 
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Regarding Claim 5, 42, Dessiatnikov discloses the prompting for input to the application server see § 
SQL Authentication vs. Windows Authentication Par. 2 & Par. 3. 

Regarding Claim 6, 19, 33, 38, Dessiatnikov discloses the requesting of database connection see § 
Connection String Properties - Table. 

Regarding Claim 7, 25, 34, 43, Dessiatnikov discloses the password and address of database see § 
Connection String Properties - Table & § SQL Authentication vs. Windows Authentication Par. 2. 

Regarding Claim 8, 35, Dessiatnikov discloses the Uniform Resource Locator see § COM+ catalog. 

Regarding Claim 9, Dessiatnikov discloses the system requesting the connection information see § 
Connection String Properties - Table. 

Regarding Claim 10, 24, Dessiatnikov discloses the user and machine specific key to be used see § 
Encrypting data Par. 4. 

Regarding Claim 11, Dessiatnikov discloses the decrypting of obtained connection information see § 
Encrypting data Par. 4. 



1 Dessiatnikov, Dmitry. "Securing SQL Connection String" SANS Institute 2004 8 Jan 2004. 
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Regarding Claim 12, 29, Dessiatnikov discloses the triple DES being used for encrypting of 
connection information see § Encrypting data Par. 3. 

Regarding Claim 13, Dessiatnikov discloses the java string see introduction Par. 2. 

Regarding Claim 14-15, Dessiatnikov discloses the automatically requesting a connection to a 
database and initialization of server see § Introduction Par. 1 & § SQL Authentication vs. Windows 
Authentication Par. 1. 

Regarding Claim 16-17, 22-23, Dessiatnikov discloses the server and J2EE standard see § Additional 
measures Par 5 & § Encrypting data Par. 5. 

Regarding Claim 18, Dessiatnikov discloses the application server to access key phrase in response 
to request to connect see § Introduction Par. 1 & § SQL Authentication vs. Windows 
Authentication Par. 1; central repository to store value string and to provide the value string to 
server upon receiving key phrase see § Storage of connection strings; node to provide requested data 
to server see § Configuration files Par 3. 

Regarding Claim 20-21, Dessiatnikov discloses the SQL database see § Abstract. 



Regarding Claim 28, Dessiatnikov discloses the encrypting of data see § Encrypting data. 
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Regarding Claim 31, Dessiatnikov discloses the network interface to connect to node see § SQL 
Authentication vs. Windows Authentication; the requesting connection information server to 
another node see § Introduction Par. 1; accessing a key phrase to decrypt the requested connection 
information to request connection information see § Encrypting data Par. 3; obtaining the requested 
connection information from secure storage file see § Storage of connection strings. 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness rejections 
set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 
of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the 
art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was 
made. 

Claim 30 is rejected under 35 U.S.C. 103(a) as being unpatentable over NPL to Dessiatnikov in view 
of US Patent 2003/0105977 to Brabson et al. (hereinafter Brabson). 

Regarding Claim 30 3 Dessiatnikov does not disclose the directory transitioning from unencrypted to 
storing encrypted data. However, Brabson disclose the directory transitioning from unencrypted to 
storing encrypted data see Fig. 10 item 1025 & 1030. It would be obvious to one having ordinary 
skill in the art at the time of the invention to include the directory transitioning from unencrypted to 
storing encrypted data in the invention of Dessiatnikov in order to use readily available resource as 
taught in Brabson see Fig. 10 item 1030 & Par. 0009. 

Conclusion 
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THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set 
forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until 
after the end of the THREE-MONTH shortened statutory period, then the shortened statutory 
period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, 
will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final 
action. 

Any inquiry concerning this communication or earlier communications from the examiner should be 
directed to Venkat Perungavoor whose telephone number is 571-272-7213. The examiner can 
normally be reached on 8:30-5:00. If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone 
number for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be 
obtained from either Private PAIR or Public PAIR. Status information for unpublished applications 
is available through Private PAIR only. For more information about the PAIR system, see 
http://pair-direct.uspt0.g9v. Should you have questions on access to the Private PAIR system, 
contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like 
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assistance from a USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Venkat Perungavoor ' ^ „ 

Examiner GILBERTO BARRON j£L 

Art Unit 2132 SUPERVISORY PATENT EXAMMER 
November 19, 2007 TECHNOLOGY CENTER 2100 



